Thousands of systems used to monitor and control European wind and solar sites are unnecessarily connected to the internet, making renewable energy infrastructure easier to locate and attack, according to internet intelligence company Modat and the Dutch National Cyber Security Centre (NCSC-NL).

Researchers identified 8,547 internet-accessible systems used by wind farms and solar parks in 35 countries. Solar parks accounted for 7,942 of the total and wind farms 605.

At one wind farm, a web page displayed live turbine data along with start, stop and reset controls. It also revealed the turbine’s location and displayed information from the web server built into its controller.

Some systems managed several turbines or an entire wind farm. The report urges operators to remove monitoring and control systems from the internet and improve oversight of connected equipment.

‘Physically, wind and sun are the most robust parts of our energy supply. Digitally, they are fragmented, often exposed to the internet and not always monitored,’ said Modat Founder and CEO Soufian El Yadmani.

Four countries accounted for 76% of the vulnerable solar systems identified in the report. They were:

• Spain: 2,766 systems.
• Greece: 1,860 systems.
• Italy: 753 systems.
• Germany: 672 systems.

Meanwhile just two countries accounted for 67% of the exposed wind systems. They were:

• Germany: 212 systems.
• Italy: 192 systems.

Operators are urged to remove monitoring and control systems from the internet and improve oversight of connected equipment in a bid to help counter the risk of cyber attacks

Source: Modat    
 

Researchers also discovered easily accessible login screens revealing information about the wind farms they served. Two named the sites they served, potentially helping hackers connect an online system to a physical location. One web page displayed a default username, while another gave a support telephone number and a notice saying the connection was monitored around the clock.

The report describes how finding one device online can help hackers identify other connected equipment, including controllers that manage an entire site. It can also help identify suppliers and maintenance companies who work across several wind farms or solar parks.

In other industries, hackers have gathered similar information to help them pretend to be employees or third-party contractors, aiding their attempts to gain access to sensitive systems.

Researchers compiled the research by scanning the internet for exposed computer systems and using machine learning to group those with similar characteristics. They then investigated which systems were used at wind farms and solar parks.

There are likely to be many more exposed systems than the 8,547 stated in the report because researchers only included a system if it could be linked beyond doubt to a specific wind farm or solar park. Therefore, a low national count does not necessarily mean fewer exposed systems.

The authors of the research have urged operators to keep control systems off the internet and only use secure connections for remote access. They recommend recording which systems are in use and who can access them, including suppliers and maintenance companies.

They said operators should plan and monitor as though an attacker has already gained access. They should also consider how equipment could be operated manually and adapt procedures to changing threats.  

The report calls for organisations across the sector to share information about threats and their experience of protecting systems.  

‘Nobody wins when a neighbour’s wind farm goes down,’ the report states.

While machine learning was used to compile the research data, it can also help attackers find targets faster. ‘What we can map in hours, an attacker can map in hours too,’ commented El Yadmani.

The study covered 40 countries across the EU, European Free Trade Association and EU candidate states. It does not suggest every identified system could be operated without authentication or that any had been breached.